Run a restore drill on a schedule: pick a system, restore it from backup into an isolated place, check the data, time it, and record what failed. CISA's ransomware guide says to test backup procedures regularly, and to test the availability and integrity of backups as part of disaster recovery.
Why drill
Backup jobs report success when they finish, not when the data is usable. Keys can be missing, formats can change and restore steps can depend on one person's memory. The only proof is a restore.
GDPR Article 32 also lists, among security measures, the ability to restore availability and access to personal data promptly after a physical or technical incident. A drill is how you show you can.
The drill, step by step
- Choose the target. Rotate through your critical systems. Include one database, one file store and one configuration or secrets backup per cycle.
- Set the clock. Note the time you start. Your recovery time target needs a real number behind it.
- Restore somewhere isolated. Use a separate account or network so the drill cannot overwrite production or reinfect it.
- Use the documented steps only. If someone says "I just know how", that is a finding.
- Fetch the encryption key the way you would in an emergency. If it requires a laptop that is also lost in the scenario, that is a finding.
- Validate the data. Check row counts, a few known records, application startup and, where relevant, checksums. CISA stresses integrity as well as availability.
- Record the results. Time taken, data age restored, problems found.
- Fix and retest. Close each finding with an owner and date.
Variations worth adding over a year
- Restore a single file or record, not the whole system.
- Restore with the primary cloud account unavailable.
- Restore from the oldest retained backup, to prove retention works.
- Run it with someone who has not done it before.
What to keep as evidence
Keep the date, system, steps followed, time, outcome and fixes. Auditors and customers like dated records. Safeguard's compliance and evidence automation can keep this type of record alongside your other controls.
A sample drill record
A useful record fits on one page. Date and participants. System restored and which backup was used, with its age. Steps followed and where the written runbook was wrong. Time from start to usable service. Validation performed and its result. Findings, each with an owner and due date. Whether the key retrieval path worked as documented. The next drill date and the system chosen for it. Over a year these pages show a pattern: faster restores, fewer surprises and a growing share of systems covered. They are also the evidence a customer questionnaire or auditor will ask for when they raise recovery.
Quick check
How often should we drill?
CISA says regularly without giving an interval. Quarterly for critical systems is a reasonable starting point, adjusted to your risk.
Can we skip it if backups are managed by a vendor?
No. Ask the vendor how to test, and run your own restore of your data at least occasionally.
Sources
Last reviewed: 19 October 2026.
